Business Directory CVE-2026-84758

No special conditions are required beyond having the Business Directory plugin active on a publicly accessible WordPress installation running version 6.4.26 or earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default plugin configurations without requiring interaction from a logged-in user. The bounded impact (I:L/A:L, C:N) suggests exploitation is limited to specific plugin-managed data operations - likely listing creation, modification, or deletion - rather than full site or database compromise. Sites where the WordPress front-end is restricted behind authentication or IP filtering are not exposed via this attack vector.

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) establishes a low-barrier, unauthenticated, network-reachable attack with bounded impact - limited integrity modification and limited availability disruption. No KEV listing and no public exploit reduce immediate urgency, but the attack complexity of AC:L and no required privileges mean that any internet-facing WordPress installation running this plugin is theoretically exploitable with minimal effort, and even a mid-sized municipal IT team in walbrzych running a community business directory portal should treat this as a prompt patching priority given how straightforward unauthenticated exploitation typically is once a missing-authorization endpoint is identified. The C:N impact component is notable: this is not a credential or data-leakage flaw, reducing its attractiveness for automated harvesting campaigns, but directory vandalism or denial-of-service through content deletion could disrupt site operations. EPSS data is not available in the provided input; absent that signal, the low attack complexity remains the dominant risk driver.

An unauthenticated attacker sends crafted HTTP POST requests to the WordPress AJAX endpoint targeting a plugin action that lacks authorization checks, bypassing access control to modify or delete business directory listings. With no credentials, no user interaction, and low complexity required, the attack is straightforward once the specific unprotected action name is identified - typically discoverable through plugin source code review or fuzzing. No public exploit code has been identified at the time of analysis.